FortiGate Firewall – VoIP Configuration

Table of Contents

Overview Before you start Ports used by VoIP Configuration 1. Disable SIP ALG / Session Helper 2. Disable VoIP Inspection Profiles (if applied) 3. Firewall Policy 4. NAT configuration 5. Traffic Shaping (QoS) 6. Disable SIP helpers on policies (GUI) Good practice Troubleshooting One-way audio Calls dropping or failing randomly Registration issues Choppy audio

Overview

This guide explains how to configure FortiGate firewalls for SIP-based VoIP.

FortiGate devices are very capable, but their default SIP handling (session helpers / ALG) often causes issues unless adjusted. Once configured properly, they’re very stable for VoIP.

Before you start

You’ll need:

Admin access (GUI or CLI)
SIP provider details
Awareness of VLANs / internal segmentation

Ports used by VoIP

SIP: 5060 (UDP/TCP), optionally 5061 (TLS)
RTP: typically UDP 10000–20000

Configuration

1. Disable SIP ALG / Session Helper

This is the most important step.

From CLI:

config system session-helper
 show

Find the SIP entry (usually ID 13), then remove it:

config system session-helper
 delete 13
end

Also set:

config system settings
 set default-voip-alg-mode kernel-helper-based
end

Why this matters:
FortiGate modifies SIP traffic by default, which can break call setup and audio routing.

2. Disable VoIP Inspection Profiles (if applied)

If a VoIP profile is attached to firewall policies:

Edit the policy
Remove or disable SIP inspection

3. Firewall Policy

Go to:

Policy & Objects → Firewall Policy

Ensure outbound policy allows:

UDP 5060
UDP 10000–20000

Destination can be:

Any
Or restricted to provider IPs (recommended)

4. NAT configuration

Ensure outbound NAT is enabled on the LAN → WAN policy.

For on-site PBX:

Use static NAT or IP pools
Avoid changing source ports where possible

5. Traffic Shaping (QoS)

FortiGate supports traffic shaping policies.

Go to:

Policy & Objects → Traffic Shaping

Create:

Policy matching UDP RTP traffic
Set priority:
- High or real-time

6. Disable SIP helpers on policies (GUI)

In some firmware versions:

Edit firewall policy
Look for:
- SIP / VoIP inspection
Disable it

Good practice

Avoid having multiple inspection layers (e.g. SIP ALG + IPS)
Keep firmware updated
Use explicit rules rather than relying on defaults

Troubleshooting

One-way audio

Typical FortiGate issue when helpers aren’t fully disabled.

Check:

Session helper removed
No VoIP inspection profile applied
RTP allowed

Calls dropping or failing randomly

Often related to:

SIP ALG still active somewhere
NAT behaviour changing

Registration issues